Attack chain completion method and device, electronic equipment and storage medium

Abstract

The application relates to an attack chain completion method and device, electronic equipment and a storage medium, and is applied to the technical field of network security. The method comprises the following steps: acquiring a security knowledge graph and an abnormal edge; determining a plurality of dependent paths in the security knowledge graph, clustering the plurality of dependent paths, obtaining a plurality of class clusters and corresponding host behavior categories; selecting a target dependent path from a dependent path to which each abnormal edge belongs; merging target dependent paths with the same entity and host behavior category in the target dependent paths corresponding to all abnormal edges in each target dependent path to obtain a plurality of local attack chains; establishing a connection between local attack chains in each class cluster according to the connection probability between entities in the local attack chains and entities in other local attack chains in the class cluster; and establishing a connection between local attack chains in different class clusters according to the connection probability between entities in each class cluster and entities in other class clusters. The application can improve the completeness of the attack chain.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an attack chain completion method, apparatus, electronic device, and storage medium. Background Technology

[0002] Cybersecurity technology aims to ensure the normal operation of computer systems and networks, and is crucial to national security and the well-being of the people. Advanced persistent threats (APS), as a new type of attack, are beginning to cause security incidents globally, using a combination of advanced attack techniques to maintain long-term and continuous control over target assets.

[0003] Among related technologies, attack attribution can be used for network security defense, effectively addressing advanced persistent threats (APS). Attack attribution records system events by collecting information such as audit logs from the host system, enabling the detection and reconstruction of the process by which APS infiltrate the host system.

[0004] However, due to incomplete data and attack attribution strategies, the initial reconstruction results have issues with missing attack chains, making it impossible to fully reproduce the attack process. This is not conducive to review by security operations personnel and affects subsequent attack handling procedures. Summary of the Invention

[0005] To address the aforementioned technical problems, this application provides an attack chain completion method, apparatus, electronic device, and storage medium.

[0006] According to a first aspect of this application, an attack chain completion method is provided, comprising:

[0007] Obtain a pre-built security knowledge graph based on host system audit logs, and abnormal edges in the security knowledge graph, wherein the nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively.

[0008] Based on the security knowledge graph, multiple dependency paths in the security knowledge graph are determined, and the multiple dependency paths are clustered to obtain multiple clusters and host behavior categories corresponding to each cluster;

[0009] Select target dependency paths from the dependency paths to which each abnormal edge belongs, and merge the target dependency paths with the same entity and host behavior category from all the target dependency paths corresponding to the abnormal edges to obtain multiple local attack chains;

[0010] For each local attack chain within each cluster, link prediction is performed between entities in that local attack chain and entities in other local attack chains within the same cluster before the timestamp corresponding to that local attack chain, to obtain the connection probability between entities in that local attack chain and entities in other local attack chains.

[0011] Select the first target entity with the highest connection probability that is located in the local attack chain and the second target entity that is located in the other local attack chains, and establish a connection between the second target entity and the first target entity;

[0012] Obtain the earliest timestamp from the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to the cluster.

[0013] Link prediction is performed on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster to obtain the connection probability between entities in each cluster and entities in the other clusters;

[0014] Select the third target entity with the highest connection probability located in that cluster and the fourth target entity located in the other clusters, and establish a connection between the fourth target entity and the third target entity.

[0015] Optionally, determining multiple dependency paths in the security knowledge graph based on the security knowledge graph includes:

[0016] An entry vertex is selected from the security knowledge graph, wherein the out-degree of the entry vertex is greater than 0, or, when the entry vertex is a file entity or a communication entity, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a first threshold, or, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a second threshold; the first threshold is less than the second threshold.

[0017] According to the graph traversal algorithm based on depth-first search, the entry vertex is traversed to determine multiple candidate paths in the security knowledge graph, and the timestamps of the vertices in the candidate paths increase with the direction of the edges;

[0018] Based on the multiple candidate paths, multiple dependency paths are determined.

[0019] Optionally, determining multiple dependent paths based on the multiple candidate paths includes:

[0020] Treat each candidate path as a dependency path; or...

[0021] If any of the candidate paths is a sub-path of another candidate path, and the number of other candidate paths is less than a preset number, then the candidate paths other than the candidate paths mentioned above will be used as dependent paths.

[0022] Optionally, the clustering of the multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster includes:

[0023] The TransR embedding model maps entities and interactions in each dependency path to embedding vectors. Based on the embedding vectors of entities and interactions, the embedding vector of each dependency path is obtained.

[0024] The embedding vectors of the multiple dependency paths are clustered using a clustering algorithm to obtain multiple clusters and the host behavior category corresponding to each cluster.

[0025] Optionally, link prediction is performed between entities in the local attack chain and entities in other local attack chains to obtain the connection probabilities between entities in the local attack chain and entities in other local attack chains, including:

[0026] The entities in the local attack chain are input into the entities in other local attack chains and a pre-established link prediction model to obtain the connection probability between the entities in the local attack chain and the entities in other local attack chains.

[0027] Link prediction is performed between entities in each cluster and entities in other clusters to obtain the connection probability between entities in each cluster and entities in other clusters, including:

[0028] The entities in each cluster and the entities in the other clusters are input into the link prediction model to obtain the connection probability between the entities in each cluster and the entities in the other clusters.

[0029] Optionally, selecting the target dependency path from the dependency paths to which each abnormal edge belongs includes:

[0030] According to the following formula:

[0031]

[0032] Calculate the i-th dependency path P to which the abnormal edge belongs. i Value score (P) i Select the dependency path with the highest value score as the target dependency path;

[0033] Where ε represents the dependency path P i The number of abnormal edges contained in the dependency path, where ∈ represents the number of edges contained in the dependency path, and v represents the dependency path P. i The number of entities contained, where τ represents the dependency path P. i Ranking of the scarcity of host behavior categories.

[0034] Optionally, before obtaining the pre-built security knowledge graph based on host system audit logs, the method further includes:

[0035] Obtain the host system audit log, extract entities from the host system design log, and identify the call relationships between entities;

[0036] Based on the calling relationships between the entities, a link is generated, and indirect interaction relationships between non-adjacent entities in the link are constructed;

[0037] The entities are used as nodes in the security knowledge graph, and the calling relationships between entities and the indirect interaction relationships between non-adjacent entities in the link are used as edges in the security knowledge graph.

[0038] According to a second aspect of this application, an attack chain completion device is provided, comprising:

[0039] The knowledge graph acquisition module is used to acquire a pre-built security knowledge graph based on host system audit logs, as well as abnormal edges in the security knowledge graph, wherein the nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively.

[0040] A dependency path determination module is used to determine multiple dependency paths in the security knowledge graph based on the security knowledge graph.

[0041] The dependency path clustering module is used to cluster the multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster;

[0042] The target dependency path determination module is used to select the target dependency path from the dependency paths to which each abnormal edge belongs;

[0043] The local attack chain determination module is used to merge target dependency paths with the same entity and host behavior category in all abnormal edges to obtain multiple local attack chains.

[0044] The first connection probability determination module is used to perform link prediction on entities in each local attack chain within each cluster and entities in other local attack chains within the cluster before the timestamp corresponding to the local attack chain, so as to obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0045] The cluster link establishment module is used to select the first target entity with the highest connection probability located in the local attack chain and the second target entity located in the other local attack chains, and to establish a connection between the second target entity and the first target entity.

[0046] The timestamp determination module is used to obtain the earliest timestamp among the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to the cluster.

[0047] The second connection probability determination module is used to perform link prediction on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster, so as to obtain the connection probability between entities in each cluster and entities in the other clusters.

[0048] The inter-cluster link establishment module is used to select the third target entity located in the same cluster and the fourth target entity located in the other clusters, which have the highest connection probability, and to establish a connection between the fourth target entity and the third target entity.

[0049] Optionally, the dependency path determination module is specifically used to select an entry vertex from the security knowledge graph, wherein the out-degree of the entry vertex is greater than 0, or, when the entry vertex is a file entity or a communication entity, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a first threshold, or, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a second threshold; the first threshold is less than the second threshold; according to a graph traversal algorithm based on depth-first search, traverse from the entry vertex to determine multiple candidate paths in the security knowledge graph, wherein the timestamps of vertices in the candidate paths increase with the direction of the edges; and according to the multiple candidate paths, determine multiple dependency paths.

[0050] Optionally, the dependency path determination module is specifically used to determine multiple dependency paths based on the multiple candidate paths through the following steps:

[0051] Treat each candidate path as a dependency path; or...

[0052] If any of the candidate paths is a sub-path of another candidate path, and the number of other candidate paths is less than a preset number, then the candidate paths other than the candidate paths mentioned above will be used as dependent paths.

[0053] Optionally, the dependency path clustering module is specifically used to map the entities and interaction relationships in each dependency path into embedding vectors through the embedding model TransR, obtain the embedding vector of each dependency path based on the embedding vectors of entities and interaction relationships, and cluster the embedding vectors of the multiple dependency paths through a clustering algorithm to obtain multiple clusters and the host behavior category corresponding to each cluster.

[0054] Optionally, the first connection probability determination module is specifically used to input entities in the local attack chain and entities in other local attack chains into a pre-established link prediction model for each local attack chain within each cluster, so as to obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0055] The second connection probability determination module is specifically used to input entities in each cluster and entities in other clusters into the link prediction model to obtain the connection probability between entities in each cluster and entities in other clusters.

[0056] Optionally, the target dependency path determination module is specifically used to determine the path according to the following formula:

[0057]

[0058] Calculate the i-th dependency path P to which the abnormal edge belongs. i Value score (P) i Select the dependency path with the highest value score as the target dependency path;

[0059] Where ε represents the dependency path P i The number of abnormal edges contained in the dependency path, where ∈ represents the number of edges contained in the dependency path, and v represents the dependency path P. i The number of entities contained, where τ represents the dependency path P. i Ranking of the scarcity of host behavior categories.

[0060] Optionally, the attack chain completion device further includes:

[0061] The host system audit log acquisition module is used to acquire host system audit logs;

[0062] The entity and call relationship extraction module is used to extract entities and the call relationships between entities from the host system design log;

[0063] An interaction relationship construction module is used to generate links based on the calling relationships between the entities, and to construct indirect interaction relationships between non-adjacent entities in the links;

[0064] The security knowledge graph construction module is used to use the entities as nodes of the security knowledge graph, and the calling relationships between entities and the indirect interaction relationships between non-adjacent entities in the link as edges of the security knowledge graph.

[0065] According to a third aspect of this application, an electronic device is provided, comprising: a processor configured to execute a computer program stored in a memory, wherein the computer program, when executed by the processor, implements the method described in the first aspect.

[0066] According to a fourth aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0067] According to a fifth aspect of this application, a computer program product is provided that, when the computer program product is run on a computer, causes the computer to perform the method described in the first aspect.

[0068] The technical solution provided in this application has the following advantages compared with the prior art:

[0069] By acquiring a pre-constructed security knowledge graph, multiple dependency paths within the graph are identified. Semantically similar dependency paths are clustered to obtain multiple clusters and their corresponding host behavior categories. Anomaly edges are retrieved from the knowledge graph. Target dependency paths are selected from the dependency paths belonging to each anomaly edge, and target dependency paths with the same entity and host behavior category are merged. The remaining multiple local attack chains, with their disconnections, are identified as missing attack chains. The attack chain completion task is transformed into a link prediction task on the security knowledge graph, which predicts the probability of a connection between two entities. By predicting the connection probability of entity pairs in two local attack chains within a cluster (each local attack chain and the local attack chain preceding its corresponding timestamp), the most likely connected entity pairs in the two local attack chains are obtained, and connections are established between entity pairs within the cluster. Similarly, the connection probability of entity pairs in local attack chains within two clusters is predicted, obtaining the most likely connected entity pairs in the local attack chains between the two clusters, thus establishing connections between entity pairs between clusters. In this way, a complete attack chain can be obtained through link completion, improving the integrity of the link reconstruction. This complete attack chain will be presented to security incident operators and used as the result of the source tracing analysis of host intrusion incidents, improving the interpretability and accuracy of attack source tracing results. Attached Figure Description

[0070] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0071] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Figure 1 This is a flowchart of an attack chain completion method in an embodiment of this application;

[0073] Figure 2 This is a flowchart illustrating the construction of a security knowledge graph in an embodiment of this application.

[0074] Figure 3 This is a schematic diagram illustrating the construction of entity relationships in an embodiment of this application;

[0075] Figure 4 This is a schematic diagram of local attack chain merging in an embodiment of this application;

[0076] Figure 5 This is a schematic diagram illustrating the prediction of the connection probability between entity pairs using a link prediction model in an embodiment of this application.

[0077] Figure 6 This is a schematic diagram of attack chain completion in an embodiment of this application;

[0078] Figure 7 This is a schematic diagram of one structure of the attack chain completion device in the embodiments of this application;

[0079] Figure 8 This is a schematic diagram of the structure of an electronic device in an embodiment of this application. Detailed Implementation

[0080] To better understand the above-mentioned objectives, features, and advantages of this application, the solution of this application will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0081] Many specific details are set forth in the following description in order to provide a full understanding of this application, but this application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some embodiments of this application, and not all embodiments.

[0082] See Figure 1 , Figure 1 This is a flowchart of an attack chain completion method in an embodiment of this application, which may include the following steps:

[0083] Step S102: Obtain a pre-built security knowledge graph based on host system audit logs, and abnormal edges in the security knowledge graph, wherein the nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively.

[0084] Host system audit logs record entities and events that occur during host operation. Different auditing tools can be used to collect host system audit logs for different operating systems. For example, the Auditd auditing tool can be used to collect host system audit logs for Linux operating systems; the ETW auditing tool can be used for Windows operating systems. A security knowledge graph can be pre-built based on the host system audit logs. See also... Figure 2 , Figure 2 A flowchart for constructing a security knowledge graph in this application embodiment may include the following steps:

[0085] Step S202: Obtain the host system audit log, extract entities from the host system design log, and the calling relationships between entities.

[0086] Entities and their inter-entity call relationships can be extracted from host system design logs. Common entities include process entities, file entities, and communication entities. Communication entities encompass internal system pipes, sockets, or IP (Internet Protocol) addresses for external communication. For example, a host system audit log might contain "process writing file," from which the process entity, file entity, and the call relationship between them—specifically, the file writing process—can be extracted.

[0087] Step S204: Generate a link based on the calling relationship between entities, and construct the indirect interaction relationship between non-adjacent entities in the link.

[0088] Since host system audit logs record system events during host runtime, they contain a large number of redundant temporary events. Focusing directly on the starting entity and ending entity of host behavior can, to some extent, avoid redundant information and facilitate understanding of behavioral semantics. Based on this, a link containing entities and call relationships can be generated according to the call relationships between pairs of entities. The interaction relationships between entities can then be constructed based on this link. Intuitively, interaction relationships are represented as higher-order connections between a process entity and other entities reachable along the same directed path.

[0089] See Figure 3 , Figure 3 This is a schematic diagram illustrating the construction of entity relationships in an embodiment of this application. The "Browser → Browser → Forged File → Trojan Process → Sensitive File" chain contains an "interaction" relationship between the "Browser" entity and the "Sensitive File" entity. However, the "Browser" entity will not interact with the "Sensitive File" entity under expected normal host behavior.

[0090] Step S206: Treat entities as nodes in the security knowledge graph, and treat the calling relationships between entities and the indirect interaction relationships between non-adjacent entities in the link as edges in the security knowledge graph.

[0091] A security knowledge graph can be viewed as a collection of triples. A triple is defined as (head, interact, tail), where "head" represents the head entity, "interact" represents the interaction relationship, including call relationships and indirect interaction relationships between entities, and "tail" represents the tail entity. This interaction relationship represents higher-order information or multi-hop connection information, and can provide a certain degree of behavioral semantics.

[0092] In a security knowledge graph, anomaly edges refer to malicious events that may be recorded as part of an attack. The goal of attack attribution is to find a complete link in the security knowledge graph that contains all identified anomaly edges, locate the entry point of the attack, and identify the subsequent impact of the attack on the system. The ability to detect anomaly edges affects the effectiveness of attack attribution; higher accuracy leads to better results. This application does not limit the method for determining anomaly edges. For example, they can be manually annotated by security event operators, or the connection probability between entities can be predicted using a link prediction model. The lower the connection probability, the more likely the edge between two entities is to be an anomaly edge. Edges between two entities with a connection probability less than a preset connection probability threshold are identified as anomaly edges.

[0093] Step S104: Based on the security knowledge graph, determine multiple dependency paths in the security knowledge graph, and cluster the multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster.

[0094] Dependency paths refer to possible paths within a security knowledge graph. They can be determined based on the graph's structure; for example, multiple dependency paths can be identified using graph traversal algorithms. If an abnormal edge belongs to a dependency path, that path can be called an abnormal dependency path, meaning the path that the abnormal edge depends on.

[0095] In some embodiments, multiple dependency paths in a security knowledge graph can be determined in the following ways:

[0096] Entry vertices are selected from the security knowledge graph. The entry vertex cannot be a terminal vertex in the security knowledge graph; that is, the out-degree of the entry vertex must be greater than 0. Alternatively, when the entry vertex is a file entity or a communication entity, if the sum of its in-degree and out-degree is too large, it indicates that the vertex is a central vertex, and a central vertex cannot be directly selected as the entry vertex. Therefore, the sum of the in-degree and out-degree of the entry vertex must be less than or equal to a first threshold. Alternatively, when the entry vertex is a process entity, file entity, or communication entity, if the sum of its in-degree and out-degree is too large, it indicates that the vertex is a dependency explosion vertex, and a dependency explosion vertex cannot be directly used as the entry vertex. Therefore, the sum of the in-degree and out-degree of the entry vertex must be less than or equal to a second threshold; the first threshold is less than the second threshold.

[0097] After selecting the entry vertex, a depth-first search-based graph traversal algorithm can be used to traverse from the entry vertex to determine multiple candidate paths in the security knowledge graph. The traversal process requires that the timestamps recorded on the edges increase in the direction of the edge. Therefore, when a vertex is reached, its timestamp is recorded, and all outgoing edges of that vertex whose timestamps increase are added to the traversal result. In each traversal step, the previous hop vertex is added, while ensuring that the timestamp of the incoming edge from the previous hop vertex to the current vertex is less than the minimum of the timestamps of all outgoing edges of the current vertex. The traversal backtracks when the termination vertex or a visited vertex is reached, and terminates when no new edges are added. The final candidate paths have vertices whose timestamps increase in the direction of the edge.

[0098] Then, multiple dependency paths can be determined based on the multiple candidate paths. Optionally, each candidate path can be directly used as a dependency path. Alternatively, it can be determined whether there is an inclusion relationship among the candidate paths. If a candidate path is contained within another N candidate paths, that is, the candidate path is a subpath of the other N candidate paths, where N is a positive integer, N can be used as the subgraph contribution of the candidate path. If a dependency path appears multiple times in different dependency paths, it means that it is more likely to be a basic host behavior. Therefore, if any candidate path is a subpath of another candidate path, and the number of other candidate paths is less than a preset number, that candidate path is filtered out, and all other candidate paths are used as dependency paths.

[0099] The security knowledge graph records the sequence of system events during host runtime, corresponding to different host behaviors. The set of dependency paths is equivalent to the set of multiple host behaviors; the greater the difference in dependency paths, the greater the difference in their behaviors. Due to the large number of dependency paths, to save on manual investigation costs, semantic aggregation can be performed on dependency paths to abstract host behaviors and cluster them into finite groups. The clustering results of the same group represent a series of similar host behaviors.

[0100] In some embodiments, an embedding model TransR can be pre-trained to map entities and interaction relationships in each dependency path into embedding vectors. Based on the embedding vectors of entities and interaction relationships, the embedding vector for each dependency path is obtained. A dependency path contains multiple interconnected triples, and the dimension of the embedding vector for each triple is fixed at 2×d+l, which is twice the dimension of the entity vector plus the dimension of the relationship vector. A weighted pooling method can be used to calculate the embedding vector of the dependency path. Summation pooling can utilize the embedding vectors of all triples to fully leverage the system event information in the dependency path. The embedding vector of a triple is defined as... The embedding vector of the dependent path can be represented as:

[0101]

[0102] Among them, weight The system event weights can be calculated using a TF-IDF-based method and used as weighting coefficients for edge e during the summation process. These weights represent the different influences and importance of different system events in the host's behavior.

[0103] In this embodiment of the application, the method for calculating system event weights based on TF-IDF is as follows:

[0104] Using timestamps from system events, timestamp windows (time ranges) of the same length are used as documents in TF-IDF. Words within a document correspond to system events recorded within that timestamp window. Therefore, the number of timestamp windows corresponds to the number of documents in the TF-IDF weighted algorithm, and the numerical range of the timestamp windows reflects the collection duration of the audit logs. The formula for calculating the weight of a system event is shown below. Adding one to the denominator during the calculation of the inverse document frequency (IVF) avoids the error of a denominator of 0. Finally, adding one to the IVF value ensures that common system events are not assigned too low a weight. The weight calculation method can be found in the following formula:

[0105]

[0106]

[0107] The weight of a system event = TF × IDF.

[0108] After calculating the embedding vectors of dependency paths based on the weighted results of system events in the security knowledge graph, a clustering algorithm is used to cluster the embedding vectors of multiple dependency paths, resulting in multiple clusters and the host behavior category corresponding to each cluster. In this embodiment, an agglomerative hierarchical clustering algorithm can be used to cluster dependency paths. The abstract result of a host behavior can be understood as a set of approximate host behaviors. The clustering algorithm can divide all dependency paths into different host behavior categories. The embedding vectors of dependency paths also benefit from the summation pooling method, thus preserving all the details of the system events. The agglomerative hierarchical clustering algorithm calculates the Euclidean distance between cluster centers to measure the difference between clusters. This application designs an adaptive method for calculating the number of clusters. Considering that the number of dependency paths varies in different scenarios, more dependency paths usually correspond to richer host behavior categories. Therefore, the square root of the number of dependency paths can be preset as the number of clusters, and a minimum of 10 clusters can be set.

[0109] The dependency path is represented as an embedding vector by weighted summation, and the dependency path set is clustered into different host behavior categories using an agglomerative hierarchical clustering algorithm, providing semantic information at the host behavior level for the attack chain completion method.

[0110] Step S106: Select target dependency paths from the dependency paths to which each abnormal edge belongs, and merge the target dependency paths with the same entity and host behavior category among all the target dependency paths corresponding to the abnormal edges to obtain multiple local attack chains.

[0111] Each anomalous edge may belong to multiple dependency paths, and these dependency paths will record duplicate graph information. If all dependency paths belonging to a single anomalous edge are treated as local attack chains, it will inevitably introduce a large amount of redundant information. Furthermore, a dependency path describes the behavior of one or more hosts, while an anomalous edge actually originates from only one host behavior. Therefore, the process of generating local attack chains involves selecting the most suitable dependency path, i.e., the target dependency path, for each marked anomalous edge in the graph. Finally, the target dependency paths selected for all anomalous edges are aggregated to generate a set of local attack chains.

[0112] Understandably, dependency paths with fewer vertices, fewer edges, fewer host behavior types, and a higher proportion of anomalous edges are more valuable as local attack chains. In some embodiments, this can be based on the following formula:

[0113]

[0114] Calculate the i-th dependency path P to which the abnormal edge belongs. i Value score (P) i Select the dependency path with the highest value score as the target dependency path;

[0115] Where ε represents the dependency path P i The number of anomalous edges contained in a dependency path is an indicator of its threat level. By statistically analyzing the proportion of anomalous edges in a dependency path, we can identify dependency paths with higher threats that require priority handling. For example, a dependency path containing a malicious Trojan process will have a large number of anomalous edges associated with that Trojan process. Dependency paths tend to include as many anomalous edges as possible to reduce the number of generated local attack chains.

[0116] ∈ represents the number of edges contained in the dependency path. As a supplementary indicator of the readability of the security knowledge graph, with the same number of entities, fewer edges are less likely to introduce too much redundant information compared to the vertices of dependency explosion, and are more conducive to clarifying the dependencies of system events.

[0117] v represents the dependency path P iThe number of entities contained in a dependency path is the most important characteristic. The fewer entities in a dependency path, the more concise and readable a local attack chain can be obtained, and the more likely it is to obtain a single host behavior rather than a series of host behaviors.

[0118] τ represents the dependency path P i The ranking of host behavior categories is based on their scarcity. Anomaly detection paths are labeled with abstract categories of host behavior. By counting the number of dependency paths in each host behavior category, they can be sorted from least to most dependent. Host behavior categories with fewer dependency paths indicate low-frequency host operations, and threat events also exhibit low-frequency characteristics. Furthermore, the scarcity of dependency paths in a host behavior category reflects a significant difference between it and other categories, warranting greater attention during the attribution process.

[0119] After selecting the most suitable dependency path for each anomalous edge, the initial attack tracing process can generate a set of local attack chains. Some local attack chains may share the same entities or even the same relationships. These local attack chains with identical graph elements do not constitute a broken chain phenomenon. Considering that the same entity appearing in different local attack chains may contribute to different host behaviors, we first merge local attack chains with the same entities and the same host behavior category. We merge the entity and relationship sets from the two local attack chains, retaining the host behavior category label, and generate a new local attack chain to replace the original two. After merging all local attack chains, the discontinuities between the remaining local attack chains can be identified as missing attack chains.

[0120] See Figure 4 , Figure 4 This is a schematic diagram of a partial attack chain merging embodiment of this application. Target dependency path 1 and target dependency path 2 with the same host behavior category and the same entity "configuration file A" can be merged. The merged partial attack chain contains both target dependency path 1 and target dependency path 2.

[0121] Step S108: For each local attack chain within each cluster, perform link prediction between entities in the local attack chain and entities in other local attack chains within the cluster before the timestamp corresponding to the local attack chain, and obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0122] Link completion refers to selecting a head entity and a tail entity from the entity sets of two local attack chains to predict whether an edge exists between the entity pairs. Within the same cluster (i.e., a grouping of entities with the same host behavior category), there are one or more local attack chains with similar semantic meanings. Link completion within a cluster can be performed according to the chronological order of the local attack chains within the group. Since multiple anomalous edges in a local attack chain will cover a time range, the anomalous edge with the earliest timestamp in each local attack chain is selected as the representative of that local attack chain. The local attack chains within the same cluster are sorted according to their timestamps. Starting from the second local attack chain, link completion is performed with the preceding local attack chains, selecting the entity pair with the highest connection probability for link completion.

[0123] Since the completed links represent "interaction relationships" in the knowledge graph, the head entity of an entity pair must be a process entity, and the two entity sets need to be swapped. The process entity sets of the two local attack chains are then traversed to determine the direction of the missing link. If an entity pair already exists between two local attack chains, and this entity pair has a corresponding edge in the security knowledge graph, but this edge does not belong to either of these two local attack chains, then an "interaction relationship" with the process entity in the entity pair as the head entity can be directly added without link prediction. To accelerate the link completion process, the link prediction results of the head and tail entities can be memorized to avoid the overhead of redundant calculations.

[0124] Optionally, entities in the local attack chain and entities in other local attack chains prior to the timestamp corresponding to the local attack chain can be input into a pre-established link prediction model to obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0125] Step S110: Select the first target entity with the highest connection probability that is located in the local attack chain and the second target entity that is located in other local attack chains, and establish a connection between the second target entity and the first target entity.

[0126] Step S112: Obtain the earliest timestamp among the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to that cluster.

[0127] Similarly, since multiple local attack chains in each cluster will cover a certain period of time, the local attack chain with the earliest timestamp in each cluster is selected as the representative of that cluster.

[0128] Step S114: Perform link prediction on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster to obtain the connection probability between entities in each cluster and entities in other clusters.

[0129] Similarly, by inputting entities in each cluster into the link prediction model with entities in other clusters, the connection probability between entities in each cluster and entities in other clusters can be obtained.

[0130] See Figure 5 , Figure 5 This diagram illustrates how a link prediction model predicts the connection probability between entity pairs in an embodiment of this application. By inputting two entities into the link prediction model, the corresponding connection probabilities can be obtained. A higher connection probability indicates a greater likelihood of a connection between the two entities, while a lower connection probability indicates a less likely connection.

[0131] Step S116: Select the third target entity with the highest connection probability that is located in this cluster and the fourth target entity that is located in other clusters, and establish a connection between the fourth target entity and the third target entity.

[0132] See Figure 6 , Figure 6 This is a schematic diagram illustrating attack chain completion in an embodiment of this application. There are four local attack chains in host behavior category "2". The last local attack chain will be linked with the first, second and third local attack chains respectively. It will obtain the maximum value in the link prediction result with an entity pair of the second chain. Therefore, the last local attack chain will be associated with the preceding local attack chain through this entity pair.

[0133] Link completion between clusters (i.e., between host behavior categories) is similar to that within a cluster (i.e., within a host behavior category). The earliest timestamp among the timestamps corresponding to each local attack chain within a cluster is used as the timestamp corresponding to the cluster. Starting from the second cluster, link completion is performed with the local attack chains in the preceding clusters according to the order of the timestamps corresponding to the clusters. The entity pair with the highest connection probability is selected for link completion. Figure 6 The attack chain completion between the middle clusters starts from the earliest local attack chain in host behavior category "3", points to the local attack chain in host behavior category "2", and finally points to the local attack chain in host behavior category "1".

[0134] The cluster completion method in this application obtains a pre-constructed security knowledge graph, determines multiple dependency paths in the security knowledge graph, clusters semantically similar dependency paths in the graph, and obtains multiple clusters and the host behavior category corresponding to each cluster. It obtains abnormal edges in the security knowledge graph, selects target dependency paths from the dependency paths to which each abnormal edge belongs, and merges target dependency paths with the same entity and host behavior category among all target dependency paths corresponding to abnormal edges. The disconnectivity between the remaining multiple local attack chains can be identified as missing attack chains. The attack chain completion task is transformed into a link prediction task on the security knowledge graph, which predicts the probability that two entities in the security knowledge graph are connected. By predicting the connection probability of entity pairs in two local attack chains within a cluster (each local attack chain and the local attack chain before its corresponding timestamp), the most likely connected entity pairs in the two local attack chains are obtained, and connections are established between entity pairs within the cluster. Similarly, by predicting the connection probability of entity pairs in local attack chains within two clusters, the most likely connected entity pairs in the local attack chains of the two clusters are obtained, thus establishing connections between entity pairs between clusters. In this way, a complete attack chain can be obtained through link completion, improving the integrity of the link reconstruction. This complete attack chain will be presented to security incident operators and used as the result of host intrusion incident tracing analysis, improving the interpretability and accuracy of attack tracing results.

[0135] Corresponding to the above method embodiments, this application also provides an attack chain completion device, see [link to relevant documentation]. Figure 7 The attack chain completion device 700 includes:

[0136] The knowledge graph acquisition module 702 is used to acquire a pre-built security knowledge graph based on host system audit logs, as well as abnormal edges in the security knowledge graph. The nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively.

[0137] The dependency path determination module 704 is used to determine multiple dependency paths in the security knowledge graph based on the security knowledge graph.

[0138] The dependency path clustering module 706 is used to cluster multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster;

[0139] The target dependency path determination module 708 is used to select the target dependency path from the dependency paths to which each abnormal edge belongs;

[0140] The local attack chain determination module 710 is used to merge target dependency paths with the same entity and host behavior category in all target dependency paths corresponding to abnormal edges to obtain multiple local attack chains.

[0141] The first connection probability determination module 712 is used to perform link prediction on entities in each local attack chain within each cluster and entities in other local attack chains within the cluster before the timestamp corresponding to the local attack chain, so as to obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0142] The cluster link establishment module 714 is used to select the first target entity with the highest connection probability located in the local attack chain and the second target entity located in other local attack chains, and to establish a connection between the second target entity and the first target entity.

[0143] The timestamp determination module 716 is used to obtain the earliest timestamp among the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to the cluster.

[0144] The second connection probability determination module 718 is used to perform link prediction on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster, so as to obtain the connection probability between entities in each cluster and entities in other clusters.

[0145] The inter-cluster link establishment module 720 is used to select the third target entity located in the same cluster and the fourth target entity located in other clusters, which have the highest connection probability, and to establish a connection between the fourth target entity and the third target entity.

[0146] Optionally, the dependency path determination module 704 is specifically used to select an entry vertex from the security knowledge graph, wherein the out-degree of the entry vertex is greater than 0, or, when the entry vertex is a file entity or a communication entity, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a first threshold, or, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a second threshold; the first threshold is less than the second threshold; according to a graph traversal algorithm based on depth-first search, traverse from the entry vertex to determine multiple candidate paths in the security knowledge graph, wherein the timestamps of vertices in the candidate paths increase with the direction of the edges; and based on the multiple candidate paths, determine multiple dependency paths.

[0147] Optionally, the dependency path determination module 704 is specifically used to determine multiple dependency paths based on multiple candidate paths through the following steps:

[0148] Treat each candidate path as a dependency path; or...

[0149] If any candidate path among multiple candidate paths is a sub-path of another candidate path, and the number of other candidate paths is less than a preset number, then the candidate paths other than the candidate paths will be used as dependent paths.

[0150] Optionally, the dependency path clustering module 706 is specifically used to map the entities and interaction relationships in each dependency path to embedding vectors through the embedding model TransR, obtain the embedding vector of each dependency path based on the embedding vectors of entities and interaction relationships, and cluster the embedding vectors of multiple dependency paths through a clustering algorithm to obtain multiple clusters and the host behavior category corresponding to each cluster.

[0151] Optionally, the first connection probability determination module 712 is specifically used to input entities in the local attack chain and entities in other local attack chains into a pre-established link prediction model for each local attack chain within each cluster, so as to obtain the connection probability between entities in the local attack chain and entities in other local attack chains.

[0152] The second connection probability determination module 718 is specifically used to input entities in each cluster and entities in other clusters into the link prediction model to obtain the connection probability between entities in each cluster and entities in other clusters.

[0153]

[0154] Calculate the i-th dependency path P to which the abnormal edge belongs. i Value score (P) i Select the dependency path with the highest value score as the target dependency path;

[0155] Where ε represents the dependency path P i The number of abnormal edges contained in the dependency path, where ∈ represents the number of edges contained in the dependency path, and v represents the dependency path P. i The number of entities contained, where τ represents the dependency path P. i Ranking of the scarcity of host behavior categories.

[0156] Optionally, the attack chain completion device 700 also includes:

[0157] The host system audit log acquisition module is used to acquire host system audit logs;

[0158] The entity and call relationship extraction module is used to extract entities from the host system design log, as well as the call relationships between entities;

[0159] The interaction relationship building module is used to generate links based on the calling relationships between entities, and to build indirect interaction relationships between non-adjacent entities in the links;

[0160] The security knowledge graph construction module is used to treat entities as nodes in the security knowledge graph and the calling relationships between entities and the indirect interaction relationships between non-adjacent entities in the link as edges in the security knowledge graph.

[0161] The specific details of each module or unit in the above-mentioned device have been described in detail in the corresponding methods, so they will not be repeated here.

[0162] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0163] In an exemplary embodiment of this application, an electronic device is also provided, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the attack chain completion method described above in this exemplary embodiment.

[0164] Figure 8 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. It should be noted that... Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0165] like Figure 8 As shown, the electronic device 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage section 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0166] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a local area network (LAN) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0167] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit 801, it performs various functions defined in the apparatus of this application.

[0168] In this embodiment of the application, a computer-readable storage medium is also provided, on which a computer program is stored, and when the computer program is executed by a processor, it implements the above-described attack chain completion method.

[0169] It should be noted that the computer-readable storage medium shown in this application can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, radio frequency, etc., or any suitable combination thereof.

[0170] In this embodiment of the application, a computer program product is also provided, which, when run on a computer, causes the computer to execute the above-described attack chain completion method.

[0171] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0172] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An attack chain completion method, characterized in that, include: Obtain a pre-built security knowledge graph based on host system audit logs, and abnormal edges in the security knowledge graph, wherein the nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively. Based on the security knowledge graph, multiple dependency paths in the security knowledge graph are determined, and the multiple dependency paths are clustered to obtain multiple clusters and host behavior categories corresponding to each cluster; Select target dependency paths from the dependency paths to which each abnormal edge belongs, and merge the target dependency paths with the same entity and host behavior category from all the target dependency paths corresponding to the abnormal edges to obtain multiple local attack chains; For each local attack chain within each cluster, link prediction is performed between entities in that local attack chain and entities in other local attack chains within the same cluster before the timestamp corresponding to that local attack chain, to obtain the connection probability between entities in that local attack chain and entities in the other local attack chains. Select the first target entity with the highest connection probability that is located in the local attack chain and the second target entity that is located in the other local attack chains, and establish a connection between the second target entity and the first target entity; Obtain the earliest timestamp from the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to the cluster. Link prediction is performed on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster to obtain the connection probability between entities in each cluster and entities in the other clusters; Select the third target entity with the highest connection probability located in the same cluster and the fourth target entity located in the other clusters, and establish a connection between the fourth target entity and the third target entity; The step of determining multiple dependency paths in the security knowledge graph based on the security knowledge graph includes: An entry vertex is selected from the security knowledge graph, wherein the out-degree of the entry vertex is greater than 0, or, when the entry vertex is a file entity or a communication entity, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a first threshold, or, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a second threshold; the first threshold is less than the second threshold. According to the graph traversal algorithm based on depth-first search, the entry vertex is traversed to determine multiple candidate paths in the security knowledge graph, and the timestamps of the vertices in the candidate paths increase with the direction of the edges; Based on the multiple candidate paths, multiple dependency paths are determined; The step of determining multiple dependent paths based on the multiple candidate paths includes: Treat each candidate path as a dependency path; or... If any of the candidate paths is a sub-path of another candidate path, and the number of other candidate paths is less than a preset number, then the candidate paths other than the candidate paths mentioned above will be used as dependent paths.

2. The method according to claim 1, characterized in that, The clustering of the multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster includes: The TransR embedding model maps entities and interactions in each dependency path to embedding vectors. Based on the embedding vectors of entities and interactions, the embedding vector of each dependency path is obtained. The embedding vectors of the multiple dependency paths are clustered using a clustering algorithm to obtain multiple clusters and the host behavior category corresponding to each cluster.

3. The method according to claim 1, characterized in that, Link prediction is performed between entities in this local attack chain and entities in other local attack chains to obtain the connection probabilities between entities in this local attack chain and entities in other local attack chains, including: The entities in the local attack chain and the entities in other local attack chains are input into a pre-established link prediction model to obtain the connection probability between the entities in the local attack chain and the entities in other local attack chains. Link prediction is performed between entities in each cluster and entities in other clusters to obtain the connection probability between entities in each cluster and entities in other clusters, including: The entities in each cluster and the entities in the other clusters are input into the link prediction model to obtain the connection probability between the entities in each cluster and the entities in the other clusters.

4. The method according to claim 1, characterized in that, The step of selecting the target dependency path from the dependency paths to which each abnormal edge belongs includes: According to the following formula: Calculate the i-th dependency path P to which the abnormal edge belongs. i Value score (P) i The dependency path with the highest value score is selected as the target dependency path. in, Indicates the dependency path P i The number of abnormal edges contained therein. v represents the number of edges contained in the dependency path, where v represents the dependency path P. i The number of entities included. Indicates the dependency path P i Ranking of the scarcity of host behavior categories.

5. The method according to claim 1, characterized in that, Before obtaining the pre-built security knowledge graph based on host system audit logs, the method further includes: Obtain the host system audit log, extract entities from the host system design log, and identify the call relationships between entities; Based on the calling relationships between the entities, a link is generated, and indirect interaction relationships between non-adjacent entities in the link are constructed; The entities are used as nodes in the security knowledge graph, and the calling relationships between entities and the indirect interaction relationships between non-adjacent entities in the link are used as edges in the security knowledge graph.

6. An attack chain completion device, characterized in that, The device includes: The knowledge graph acquisition module is used to acquire a pre-built security knowledge graph based on host system audit logs, as well as abnormal edges in the security knowledge graph, wherein the nodes and edges in the security knowledge graph are entities in the host system audit logs and the interaction relationships between entities, respectively. A dependency path determination module is used to determine multiple dependency paths in the security knowledge graph based on the security knowledge graph. The dependency path clustering module is used to cluster the multiple dependency paths to obtain multiple clusters and the host behavior category corresponding to each cluster; The target dependency path determination module is used to select the target dependency path from the dependency paths to which each abnormal edge belongs; The local attack chain determination module is used to merge target dependency paths with the same entity and host behavior category in all abnormal edges to obtain multiple local attack chains. The first connection probability determination module is used to perform link prediction on entities in each local attack chain within each cluster and entities in other local attack chains within the cluster before the timestamp corresponding to the local attack chain, so as to obtain the connection probability between entities in the local attack chain and entities in other local attack chains. The cluster link establishment module is used to select the first target entity with the highest connection probability located in the local attack chain and the second target entity located in the other local attack chains, and to establish a connection between the second target entity and the first target entity. The timestamp determination module is used to obtain the earliest timestamp among the timestamps corresponding to each local attack link in each cluster, and use the earliest timestamp as the timestamp corresponding to the cluster. The second connection probability determination module is used to perform link prediction on entities in each cluster and entities in other clusters before the timestamp corresponding to that cluster, so as to obtain the connection probability between entities in each cluster and entities in the other clusters. The inter-cluster link establishment module is used to select the third target entity located in the same cluster and the fourth target entity located in the other clusters, which have the highest connection probability, and to establish a connection between the fourth target entity and the third target entity. The dependency path determination module is specifically used to select an entry vertex from the security knowledge graph, wherein the out-degree of the entry vertex is greater than 0, or, when the entry vertex is a file entity or a communication entity, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a first threshold, or, the sum of the in-degree and out-degree of the entry vertex is less than or equal to a second threshold; the first threshold is less than the second threshold; according to a graph traversal algorithm based on depth-first search, traversal is performed from the entry vertex to determine multiple candidate paths in the security knowledge graph, wherein the timestamps of vertices in the candidate paths increase with the direction of the edges; and multiple dependency paths are determined based on the multiple candidate paths; The dependency path determination module is specifically used to determine multiple dependency paths based on the multiple candidate paths through the following steps: Treat each candidate path as a dependency path; or... If any of the candidate paths is a sub-path of another candidate path, and the number of other candidate paths is less than a preset number, then the candidate paths other than the candidate paths mentioned above will be used as dependent paths.

7. An electronic device, characterized in that, include: A processor for executing a computer program stored in a memory, wherein the computer program, when executed by the processor, implements the method of any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-5.

Images